Supermicro BMC: crafted RAKP message can establish an RMCP+ session without valid credentials

Impact

A flaw in the BMC's RAKP+ handshake lets an attacker who sends a request followed by a specially crafted RAKP message bring up an RMCP+ session and then issue IPMI commands through it. That is unauthenticated access to the out-of-band controller of the server: power control, boot device selection, serial-over-LAN and KVM, and the inventory of what is in the chassis. On a GPU host this is a path to interfering with a node that other tenants' jobs depend on, and to persistent presence on a processor that survives host reinstalls. Exploit complexity is rated high, which usually means the handshake has to be won under specific timing or value conditions rather than on demand.

Who can reach it

Network, no credentials required: anyone who can reach the BMC's IPMI/RMCP+ listener, i.e. anyone on the management VLAN or anywhere a BMC has been exposed more widely.

What to do

Flash the BMC firmware version named in Supermicro's October 2026 BMC/IPMI advisory for the affected X12SPI boards. The flash is out of band; expect a BMC reset and dropped IPMI/KVM sessions, so run it when the node is not mid-job. Interim mitigation is network-level only: restrict UDP 623 to management jump hosts and, if the fleet is managed entirely over Redfish, disable the IPMI-over-LAN channel.

References

Related entries

• Dell OMSA: unauthenticated SSRF turns the management agent into a proxy into the management VLANCVE-2026-81446 · Dell OpenManage Server Administrator (SSRF, unauthenticated)High
• Intel SGX (L1 terminal fault on enclave pages): Speculative execution lets code outside an enclave read the enclave'sCVE-2018-3615 · Intel SGX (L1 terminal fault on enclave pages)High
• AMD Secure Processor Secure OS - memory buffer checking: A malicious trusted application can read and write the ASPCVE-2022-23817 · AMD Secure Processor Secure OS - memory buffer checkingHigh
• Lenovo XClarity Controller (XCC) - LDAP/AD authorization: When XCC is configured to authenticate against ActiveCVE-2023-29057 · Lenovo XClarity Controller (XCC) - LDAP/AD authorizationHigh
• BMC firmware for Intel Server Boards S2600WF / S2600ST / S2600BP before 02.01.0017 and M50CYP, and OpenBMC firmwareCVE-2023-29164 · BMC firmware for Intel Server Boards S2600WF / S2600ST / S2600BP before 02.01.0017 and M50CYP, and OpenBMC firmware…High
• Linux bnxt_en driver (bnxt_fill_hw_rss_tbl): Memory out-of-bounds in the RSS indirection-table path of the Broadcom NICCVE-2024-44933 · Linux bnxt_en driver (bnxt_fill_hw_rss_tbl)High